Prime Numbers

322 Chapter 7 ELLIPTIC CURVE ARITHMETIC
the point at infinity, define a commutative operation + with inverse operation
− as follows:
(1) −O = O;
(2) −P1 =(x1, −y1);
(3) O + P1 = P1;
(4) if P2 = −P1, thenP1 + P2 = O;
(5) if P2 = −P1, thenP1 + P2 =(x3,y3), with
x3 = m 2 − C − x1 − x2,
−y3 = m(x3 − x1)+y1,
where the slope m is defined by
⎧
y2 − y1
⎪⎨ , if x2 = x1
x2 − x1
m =
⎪⎩
3x2 1 +2Cx1 + A
, if x2 = x1.
2y1
The addition/subtraction operations thus defined have an interesting geometrical
interpretation in the case that the underlying field F is the real number
field. Namely, 3 points on the curve are collinear if and only if they sum to 0.
This interpretation is generalized to allow for a double intersection at a point
of tangency (unless it is an inflection point, in which case it is a triple intersection).
Finally, the geometrical interpretation takes the view that vertical
lines intersect the curve at the point at infinity. When the field is finite, say
F = Fp, the geometrical interpretation is not evident, as we realize Fp as the
integers modulo p; in particular, the division operations for the slope m are
inverses (mod p).
It is a beautiful outcome of the theory that the curve operations in
Definition 7.1.2 define a group; furthermore, this group has special properties,
depending on the underlying field. We collect such results in the following
theorem:
Theorem 7.1.3 (Cassels). An elliptic curve E(F ) together with the operations
of Definition 7.1.2 is an abelian group. In the finite-field case the group
E(F p k) is either cyclic or isomorphic to a product of two cyclic groups:
with d1|d2 and d1|p k − 1.
E ∼ = Zd1 × Zd2,
That E is an abelian group is not hard to show, except that establishing
associativity is somewhat tedious (see Exercise 7.7). The structure result for
E
Fpk may be found in [Cassels 1966], [Silverman 1986], [Cohen 2000].
If the field F is finite, E(F ) is always a finite group, and the group order,
#E(F ), which is the number of points (x, y) on the affine curve plus 1 for